@stacksjs/ts-cloud 0.7.116 → 0.7.118

package/dist/{chunk-ck9gzxr0.js → chunk-kk68jrm3.js}

@@ -1480,6 +1480,9 @@ function shipsARelease(site) {
   const kind = resolveSiteKind(site);
   return kind !== "bucket" && kind !== "redirect" && kind !== "proxy";
 }
+function shipsToBucket(site) {
+  return resolveSiteKind(site) === "bucket";
+}
 function deployShipsFiles(config, onlySite) {
   if (resolveDeploymentMode(config) === "serverless")
     return true;
@@ -2667,8 +2670,8 @@ class AwsDriver {
 
 // src/drivers/hetzner/driver.ts
 import { execFileSync, execSync } from "node:child_process";
-import { randomUUID } from "node:crypto";
-import { existsSync, readFileSync as readFileSync2 } from "node:fs";
+import { createHash, randomUUID } from "node:crypto";
+import { createReadStream, existsSync, readFileSync as readFileSync2 } from "node:fs";
 
 // src/drivers/shared/fleet.ts
 function resolveFleetTopology(compute = {}) {
@@ -3209,6 +3212,15 @@ async function writeDriverState(stackName, state) {
 // src/drivers/hetzner/driver.ts
 var SSH_MAX_BUFFER = 1024 * 1024 * 256;
 var SSH_ERROR_OUTPUT_LIMIT = 8000;
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'"'"'`)}'`;
+}
+async function sha256File(path) {
+  const hash = createHash("sha256");
+  for await (const chunk of createReadStream(path))
+    hash.update(chunk);
+  return hash.digest("hex");
+}
 function sshErrorOutput(value) {
   const output = Buffer.isBuffer(value) ? value.toString("utf8") : typeof value === "string" ? value : "";
   return output.replace(/(^|\n)(\s*(?:export\s+)?[A-Za-z_][A-Za-z0-9_]*=).*$/gm, "$1$2[redacted]").replace(/encrypted:[A-Za-z0-9+/=]+/g, "encrypted:[redacted]").trim().slice(-SSH_ERROR_OUTPUT_LIMIT);
@@ -3838,11 +3850,34 @@ class HetznerDriver {
     const stagingStem = options.remoteKey.replace(/^releases\//, "").replace(/\.tar\.gz$/, "").replace(/\//g, "-");
     const stagingName = `${stagingStem}-${randomUUID()}.tar.gz`;
     const remotePath = `/var/ts-cloud/staging/${stagingName}`;
+    const digest = await sha256File(options.localPath);
+    const artifactDir = "/var/ts-cloud/artifacts";
+    const cachedPath = `${artifactDir}/${digest}.tar.gz`;
     for (const target of targets) {
       if (!target.publicIp) {
         throw new Error(`Target ${target.id} has no public IP for SCP upload`);
       }
-      this.scpToHost(target.publicIp, options.localPath, remotePath);
+      const stageCached = [
+        "set -euo pipefail",
+        `mkdir -p ${shellQuote(artifactDir)} /var/ts-cloud/staging`,
+        `test -s ${shellQuote(cachedPath)}`,
+        `cp -- ${shellQuote(cachedPath)} ${shellQuote(remotePath)}`
+      ].join(`
+`);
+      try {
+        this.sshExec(target.publicIp, stageCached);
+        continue;
+      } catch {}
+      const uploadPath = `${artifactDir}/.${digest}-${randomUUID()}.tmp`;
+      this.scpToHost(target.publicIp, options.localPath, uploadPath);
+      this.sshExec(target.publicIp, [
+        "set -euo pipefail",
+        `chmod 600 ${shellQuote(uploadPath)}`,
+        `mv -f -- ${shellQuote(uploadPath)} ${shellQuote(cachedPath)}`,
+        `cp -- ${shellQuote(cachedPath)} ${shellQuote(remotePath)}`,
+        `find ${shellQuote(artifactDir)} -type f -name '*.tar.gz' -mtime +7 -delete 2>/dev/null || true`
+      ].join(`
+`));
     }
     return { artifactRef: remotePath };
   }
@@ -6179,21 +6214,21 @@ function buildGitCheckoutScript(options) {
   const lines = [`rm -rf ${releaseDir}`, `mkdir -p ${releaseDir}`];
   if (repository.strategy === "tag") {
     if (repository.tag) {
-      lines.push(`git clone -q --depth 1 --branch ${shellQuote(repository.tag)} ${shellQuote(url)} ${releaseDir}`);
-      lines.push(`printf '%s' ${shellQuote(repository.tag)} > ${releaseDir}/.ts-cloud-tag`);
+      lines.push(`git clone -q --depth 1 --branch ${shellQuote2(repository.tag)} ${shellQuote2(url)} ${releaseDir}`);
+      lines.push(`printf '%s' ${shellQuote2(repository.tag)} > ${releaseDir}/.ts-cloud-tag`);
     } else {
       const pattern = repository.tagPattern || DEFAULT_TAG_PATTERN;
-      lines.push(`TS_CLOUD_TAG="$(git ls-remote --tags --refs --sort=-v:refname ${shellQuote(url)} ${shellQuote(`refs/tags/${pattern}`)} | head -n1 | sed 's#.*refs/tags/##')"`, `test -n "$TS_CLOUD_TAG" || { echo "no tags matching" ${shellQuote(pattern)} "found in" ${shellQuote(url)} >&2; exit 1; }`, `git clone -q --depth 1 --branch "$TS_CLOUD_TAG" ${shellQuote(url)} ${releaseDir}`, `printf '%s' "$TS_CLOUD_TAG" > ${releaseDir}/.ts-cloud-tag`);
+      lines.push(`TS_CLOUD_TAG="$(git ls-remote --tags --refs --sort=-v:refname ${shellQuote2(url)} ${shellQuote2(`refs/tags/${pattern}`)} | head -n1 | sed 's#.*refs/tags/##')"`, `test -n "$TS_CLOUD_TAG" || { echo "no tags matching" ${shellQuote2(pattern)} "found in" ${shellQuote2(url)} >&2; exit 1; }`, `git clone -q --depth 1 --branch "$TS_CLOUD_TAG" ${shellQuote2(url)} ${releaseDir}`, `printf '%s' "$TS_CLOUD_TAG" > ${releaseDir}/.ts-cloud-tag`);
     }
   } else if (commit) {
-    lines.push(`git -C ${releaseDir} init -q`, `git -C ${releaseDir} remote add origin ${shellQuote(url)}`, `git -C ${releaseDir} fetch -q --depth 1 origin ${shellQuote(commit)}`, `git -C ${releaseDir} checkout -q FETCH_HEAD`);
+    lines.push(`git -C ${releaseDir} init -q`, `git -C ${releaseDir} remote add origin ${shellQuote2(url)}`, `git -C ${releaseDir} fetch -q --depth 1 origin ${shellQuote2(commit)}`, `git -C ${releaseDir} checkout -q FETCH_HEAD`);
   } else {
-    lines.push(`git clone -q --depth 1 --branch ${shellQuote(branch)} ${shellQuote(url)} ${releaseDir}`);
+    lines.push(`git clone -q --depth 1 --branch ${shellQuote2(branch)} ${shellQuote2(url)} ${releaseDir}`);
   }
   lines.push(`git -C ${releaseDir} rev-parse HEAD > ${releaseDir}/.ts-cloud-sha`);
   return lines;
 }
-function shellQuote(value) {
+function shellQuote2(value) {
   const escaped = value.split("'").join("'\\''");
   return `'${escaped}'`;
 }
@@ -6382,7 +6417,7 @@ var noopLogger2 = {
   step: () => {},
   success: () => {}
 };
-function shellQuote2(value) {
+function shellQuote3(value) {
   return `'${value.replace(/'/g, `'"'"'`)}'`;
 }
 async function deploySiteRelease(driver, options, logger = noopLogger2) {
@@ -6914,7 +6949,7 @@ async function renewRpxCertificates(options) {
     return true;
   }
   logger.step("Issuing rpx TLS certificates after DNS reconciliation...");
-  const certChecks = certDomains.map((domain) => `test -s ${shellQuote2(`${rpxConfig.productionCerts.certsDir}/${domain}.crt`)}`).join(" && ");
+  const certChecks = certDomains.map((domain) => `test -s ${shellQuote3(`${rpxConfig.productionCerts.certsDir}/${domain}.crt`)}`).join(" && ");
   const result = await driver.runRemoteDeploy({
     targets,
     commands: [
@@ -7023,4 +7058,4 @@ function buildCloudFrontOriginConfig(options) {
     CustomErrorResponses: { Quantity: 0 }
   };
 }
-export { collectServerDnsDomains, removeStaleServerAddressRecords, normalizePublicIpv6, IPV6_EXCLUDED_HOST_LABELS, hostAcceptsIpv6, reconcileAddressRecords, verifyAddressRecord, PANTRY_PROJECT_DIR, buildPantryBootstrapScript, buildVitessProvisionScript, pgAdminCommand, BACKUP_RUNNER_PATH, buildBackupRestoreScript, siteInstallBase, isPhpSite, resolveProxyUpstreams, hasProxyUpstream, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, shipsARelease, deployShipsFiles, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, planHetznerServerResize, isHetznerCapacityError, executeHetznerServerResize, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, collectHetznerResizeManifest, prepareHetznerResize, verifyHetznerResize, resolveHetznerHostOptimizationPlan, buildHetznerHostOptimizationScript, applyHetznerHostOptimization, collectHetznerHostOptimizationReport, verifyHetznerHostOptimization, resizeCheckpointPath, resizeLockPath, readResizeCheckpoint, writeResizeCheckpoint, acquireResizeLock, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, buildHostCleanupScript, MANAGEMENT_DASHBOARD_SITE, dashboardCredentialsFile, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, renewRpxCertificates, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };
+export { collectServerDnsDomains, removeStaleServerAddressRecords, normalizePublicIpv6, IPV6_EXCLUDED_HOST_LABELS, hostAcceptsIpv6, reconcileAddressRecords, verifyAddressRecord, PANTRY_PROJECT_DIR, buildPantryBootstrapScript, buildVitessProvisionScript, pgAdminCommand, BACKUP_RUNNER_PATH, buildBackupRestoreScript, siteInstallBase, isPhpSite, resolveProxyUpstreams, hasProxyUpstream, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, shipsARelease, shipsToBucket, deployShipsFiles, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, planHetznerServerResize, isHetznerCapacityError, executeHetznerServerResize, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, collectHetznerResizeManifest, prepareHetznerResize, verifyHetznerResize, resolveHetznerHostOptimizationPlan, buildHetznerHostOptimizationScript, applyHetznerHostOptimization, collectHetznerHostOptimizationReport, verifyHetznerHostOptimization, resizeCheckpointPath, resizeLockPath, readResizeCheckpoint, writeResizeCheckpoint, acquireResizeLock, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, buildHostCleanupScript, MANAGEMENT_DASHBOARD_SITE, dashboardCredentialsFile, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, renewRpxCertificates, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };

package/dist/{chunk-f52r4fsk.js → chunk-s9m4vfcr.js}

@@ -50,7 +50,7 @@ import {
   resolveSiteKind,
   resolveUiSource,
   siteInstallBase
-} from "./chunk-ck9gzxr0.js";
+} from "./chunk-kk68jrm3.js";
 import {
   SSMClient
 } from "./chunk-7m60qnc8.js";

package/dist/deploy/index.js

@@ -36,7 +36,7 @@ import {
   synchronizeDashboardUsers,
   trackDashboardOperation,
   verifyStaticApiOrigin
-} from "../chunk-f52r4fsk.js";
+} from "../chunk-s9m4vfcr.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -78,10 +78,11 @@ import {
   resolveSiteKind,
   resolveUiSource,
   shipsARelease,
+  shipsToBucket,
   siteInstallBase,
   validateDeploymentConfig,
   verifyAddressRecord
-} from "../chunk-ck9gzxr0.js";
+} from "../chunk-kk68jrm3.js";
 import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
 import"../chunk-rds0sy87.js";
@@ -100,6 +101,7 @@ export {
   synchronizeDashboardUsers,
   startLocalDashboardServer,
   siteInstallBase,
+  shipsToBucket,
   shipsARelease,
   setMaintenance,
   sanitizeCloudConfig,

package/dist/deploy/site-target.d.ts

@@ -97,6 +97,8 @@ export declare function validateDeploymentConfig(config: CloudConfig): Deploymen
  * regenerated from the full `sites` model, not from this list.
  */
 export declare function shipsARelease(site: SiteConfig): boolean;
+/** Does the static object-storage pipeline own this site? */
+export declare function shipsToBucket(site: SiteConfig): boolean;
 /**
  * Does this deploy put any file from the working tree onto a server or into a
  * bucket?

package/dist/drivers/index.js

@@ -68,7 +68,7 @@ import {
   waitForSsh,
   wrapCloudInitUserData,
   writeResizeCheckpoint
-} from "../chunk-ck9gzxr0.js";
+} from "../chunk-kk68jrm3.js";
 import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
 import"../chunk-rds0sy87.js";

package/dist/index.js

@@ -208,7 +208,7 @@ import {
   verifyUpdateSignature,
   webhookEndpoint,
   zeroCapacity
-} from "./chunk-f52r4fsk.js";
+} from "./chunk-s9m4vfcr.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -341,7 +341,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "./chunk-ck9gzxr0.js";
+} from "./chunk-kk68jrm3.js";
 import {
   EC2Client,
   SSMClient